Guess Meme Rust

QuillAudits26 Feb 2025Files named in the report

Audit · firm’s term: audit report

QuillAudits reviewed Guess Meme Rust on 26 Feb 2025: 8 findings, 0 critical; 2 marked fixed, 6 open.

No open critical findings

Open the report Open Guess Meme Rust’s security record

Report hosted on quillaudits.com.

Trustblock does not review code.

Findings8

Statuses are the security firm’s own, from its report.

Severity	Open	Fixed
Critical	0	0
High	3	1
Medium	3	0
Low	0	1

HighPossible lock of funds due to the tendency of complete status remaining activeOpen

The bonding curve's funds can become permanently locked if all tokens are not sold. The withdraw function requires complete status, which is only set when real_token_reserves reaches zero, creating a potential deadlock scenario. Complete status solely depends on selling all tokens (Not 80% of tokens). There is a possibility that the bonding curve will not sell tokens until the real token reserve value becomes 0.

HighThe create instruction is susceptible to unlimited minting attack and pump/dump scenarioOpen

1. Unlimited Minting Exploits - With the dependence on admin calling the meta function, there are high chances for users to mint an unlimited amount of the tokens before admin action. 2. Price Manipulation Attack - Users can manipulate the price as at the point of creating tokens so it is favorable for a pump and dump scenario.

HighZero Token Withdrawal Risk: Complete Status Only Triggered After Last Token SaleOpen

The bonding curve's "complete" status, which enables withdrawal, is only triggered when the last token is sold. This design means there will be no tokens left to withdraw when the withdraw authority calls the withdraw function.

Mediummax_allowed_amount will be bypassed by usersOpen

Each token created has a max_supply_percent that should not be bypassed, however the current check allows users to bypass the max_allowed_amoun, notice the check (ctx.accounts.associated_user.amount + famount) <= max_allowed_amount the issue here is the check is not on the total sold but the amount the user already has however this is wrong as users who have exceeded the max allowed, can transfer their amount out before calling buy tokens, passing the max_allowed, then transfer their amount back in. This is possible because the max_allowed was not checked on the total sold but on the account current balance.

MediumRent set aside for storage is never redeemedOpen

In the pub fn withdraw() after the bonding curve has been completed and data cleared, it does not refund the rent set aside to pay for storage, note: The amount of SOL that can be earned from closing an account is proportional to how large the account was.

MediumUnchecked SOL Balance in Sell Function: Risk of Failed Transfers Due to Insufficient BalanceOpen

The sell function updates the bonding curve state and attempts transfers without first validating if the bonding curve has sufficient SOL balance. This could lead to failed transfers and inconsistent state. There is no validation of the actual SOL balance before the state update, assuming that the real_sol_reserves matches the actual balance in the bonding curve. In essence, it violates the checks-effects-interaction pattern with the missing checks.